Tag Info

Hot answers tagged

46

There is no "patch". It's a vulnerability in the protocol, not a bug in the implementation. In Windows Server 2003 to 2012 R2 the SSL / TLS protocols are controlled by flags in the registry set at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols. To disable SSLv3, which the POODLE vulnerability is concerned with, ...


26

A person with administrative (or often even physical) access to a server is going to be able to extract the private key. Whether through exporting, memory sniffing, or other such trickery. Your administrators have access to the private keys of your web servers. Accept this as fact, and work around that. If your sysadmins aren't trustworthy, then you may ...


20

Just for ease of installation I derived this "disable ssl 2 and 3.reg" file from Evan's answer above: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] "Enabled"=dword:00000000 ...


17

If you're not using IIS, you absolutely should remove it, for the reasons you mentioned - maintenance and security. The only effect of removing IIS is an inability to use IIS. No management or operational side effects - it hasn't been entrenched into the operating system like Internet Explorer has. Of the over 250 Windows servers I manage, less than 10 ...


15

No. Microsoft offers an FTP over SSL (FTPS) solution but does not currently provide a solution for securing FTP traffic using FTP over SSH (SFTP)


13

There are a number of things that could be causing this - unfortunately, we probably need a bit more information. Before I get into my actual response, just a quick point on your HTML pages: generally speaking, the application pool can only respond to a certain number of requests at a time. If it is busy responding to requests for dynamic pages, then it may ...


12

Neither the Microsoft IIS server, nor Windows itself, support SFTP (or SSH) at all, on any version of IIS or Windows. IIS supports secure FTP (FTPS or FTP over TLS/SSL) though. It's a different (incompatible) protocol than SFTP, but most "FTP" clients support both SFTP and FTPS. When setting up an FTPS server, make sure you disable plain (unencrypted) FTP! ...


11

When you import the key, you have the option of marking it as non-exportable. This will prevent you from using IIS or the certificate MMC to export it. At least, it makes it a little harder. However, if they have an administrator account on the machine, or have physical access to it - they will still be able to get the key through other means.


10

Powershell to disable SSL2 and SSL3: 2..3 | %{ New-ItemProperty -Path "HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL $_.0\Server" -Name Enabled -PropertyType "DWORD" -Value 0 -Force }


9

IIS is not required on any Windows system, unless you want to host web sites; the only exception is if you are using any server role which runs on web services (such as WSUS) or offers them (such as Certificate Services). However, if you actually have any dependency on IIS, Windows itself will warn you about this when you try to remove the role; if this is ...


9

Passive FTP requires that the FTP server have ports opened to it from the external network. Azure VM's use NAT, and thus needs extra configuration in order to support passive FTP. The (rough) checklist: Set the external VIP in the IIS FTP manager Set the port range to use (you might wanna show some moderation here - configuring thousands of ports are not ...


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


8

To address the most basic part of your question: Yes, you can send commands to a Windows Server from a web interface using the PowerShell Web Access feature in Windows Server 2012 and 2012 R2. For what you want (linking a user control in a web page to the execution of a specific action on the server), you might want to look into executing PowerShell from ...


8

There's a fairly good chance you're missing the correct VC++ runtime for the version of PHP you're running. If you're running PHP 5.5.x you need to ensure the VC++11 runtime is installed: http://www.microsoft.com/en-us/download/details.aspx?id=30679 Make sure you download and install the x86 version (vcredist_x86.exe), PHP on Windows isn't 64 bit yet. ...


6

Open your IIS manager and select the directory you want to protect. Under the "IIS" section select "Authentication". Disable "Anonymous Auth". Enable the desired Auth method (usually "Basic Auth") and it will be valid for this directory only. Add a User account. Give that user Read, Execute, List Permissions on the directory needed, then login via the newly ...


6

This is a bug in Chrome. You can see in the code that Chrome maintains a list of registry controlled domains and that it needs updated as each gTLD is added. You can see in the effective_tld_names.dat file that the .care domain is not listed, though its listed for other browsers that use a more recent version of the Public Suffix List. This is what causes ...


6

The trick would be to run the Apache and IIS on different ports (only one service can bind to one port at a time), though there's far from any guarantee that WSUS or ePO would work properly on non-standard ports. McAfee's support was correct in recommending not running the two things on the same server, though both pieces of software do have options for ...


5

'USERTrust RSA Certification Authority' is not recognized as a root CA on all platforms. So, the best option is use it as an intermediate CA, having a certificate signed by 'AddTrust External CA Root'. You can retrieve this certificate at http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt Proper installation (most accepted) of your certificate is: Root ...


5

Here's a PowerShell that will test for the presence of the registry keys, create them if needed, and then enter the necessary values to disable SSL 2.0 and SSL 3.0 $regPath1 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL 2.0' $regPath2 = 'HKLM:SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Protocols\SSL ...


5

There is a free utility from Nartac that you can use to disable the protocols. https://www.nartac.com/Products/IISCrypto/Default.aspx


4

IIS provides a certificate chain to the client using the certificates loaded in the server computer's registry. You need to obtain the missing intermediate certificate and install it onto the server so that it can provide a complete certificate chain to clients.


4

In general, it's not a good idea to mix user data with application code. You should maintain these separately, as code lives better in a repo, while data lives in a DB or a "raw" storage system - very different ways of storing information. When you say "a ton" of documents, what does that mean? If you're looking at 100s of GBs in thousands of files, then a ...


4

In order to successfully install the PHP manager for IIS 8, you need the .NET 3.5 framework installed and enabled, and for some reason, that's not part of the setup, which does download the .NET 2.0 framework. So, just add the .NET 3.5 framework manually (you can do so through the "add features" wizard), and the your PHP manager should install properly. ...


4

You can use Microsoft's log parser utility. It has the capability of dumping into a SQL database as well as having the ability to create a checkpoint file so that it only imports records it hasn't processed. It can be used either as a stand alone executable or programmatically invoked via an ActiveX control


4

This is seems to be covered fairly well in install.txt included in the PHP zip downloads. Quoting from that file ... Manual Installation Steps ... Upgrading from a previous PHP version: Previous editions of the manual suggest moving various ini and DLL files into your SYSTEM (i.e. C:\WINDOWS) folder and while this simplifies ...


4

It seems that you are actually asking how to change HTTP ports in IIS. Open Internet Information Services (IIS) Manager (from Administrative tools) Connections pane: COMPUTER NAME Sites Default Web Site Actions pane: Edit Site Bindings... Just select the binding http->80 and edit it to meet your requirements. Repeat for any other sites bind ...


3

It should default to the exchange server's name with OWA on the end: https://ExchangeServer/OWA Does that work? If not, try it with your domain as well: https://ExchangeServer.domain.local/OWA


3

For the sake of completeness, and/or to help out the next guy who has this problem and doesn't have his OWA server at the default virtualpath, you can find out through the IIS Manager on the server hosting Outlook Web App. Navigate to the OWA site, check the Advanced Settings to get your OWA Virtual path, and append that to the server name and/or whatever ...


3

The default path, as others have mentioned, is https://servername/OWA. If the default doesn't work, or if you simply want to double-check how the server is actually configured, you can use the Get-OwaVirtualDirectory command in the Exchange Management Shell. Also, here's some documentation about managing Outlook Web App: ...


3

Not really knowing what server you are actually looking at we can only guess. Adding to what GregL and Jim B said. My guess is you're migrating from Server 2003 Standard, IIS 6.5, Access 2007 using ASP classic code pages connecting via OLEDB static. You might be planning on importing your Access using Upsizing Wizard (which kind of works most of the ...



Only top voted, non community-wiki answers of a minimum length are eligible